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DETAILED ACTION 

This office action is responsive to communication filed on 06/29/2001. 

Claim Objections 

1 . Claims 14-19, 31 , 35, and 36 are objected to as being dependent upon a rejected 
base claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

Claim Rejections -35 USC §102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

3. Claims 1-10, 20-28, 30, and 32-34 are rejected under 35 U.S.C. 102(e) as being 
unpatentable by Donaldson et al (U.S. 6,321,267 B1). 

Regarding claim 1: Donaldson et al teach a method suitable for use in a 
communication device for determining the disposition of incoming e-mail from a sender 
(column 2, lines 37-41; fig. 1, items 1045-1048), said method comprising the steps of: 

establishing the identity of the sender to provide a sender identifier (column 6, 
lines 14-20; column 14, lines 63-67; fig. 14, items 1401-1406); 
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determining a cumulative penalty count value associated with said sender 
identifier {column 23, lines 25-36; column 22, lines 25-33; fig. 16, items 1500-1518; note 
that the penalty count value here is the threshold number points or the matching count); 

retrieving a system resource usage status associated with the communication 
device (column 6, lines 42-52); and 

processing the incoming e-mail on the basis of said cumulative penalty count 
value and said system resource usage status (column 22, lines 28-33; column 16, 12- 
19). 

Regarding claim 2: Donaldson et al teach the method of claim 1 wherein said 
step of establishing the identity of the sender comprises the step of ascertaining an IP 
address for the sender (column 6, lines 14-20). 

Regarding claim 3: Donaldson et al teach the method of claim 1 wherein said 
step of establishing the identity of the sender comprises the step of associating the 
sender with a peer IP address of the sender TCP connection (column 6, lines 42-52). 

Regarding claim 4: Donaldson et al teach the method of claim 1 wherein said 
step of determining a cumulative penalty count value comprises the step of assessing a 
penalty count value to said sender identifier for an undesirable activity associated with 
the sender (column 22, lines 23-33; note that the penalty count value here is the 
threshold number points and if the value of the match point exceeds the threshold, there 
is an undesirable activity associated with the remote host ). 

Regarding claim 5: Donaldson et al teach the method of claim 4 wherein said 
cumulative penalty count value comprises an activity penalty count charged to the 
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sender for current undesirable sender activity and a time-dependent penalty count 
determined from previous undesirable sender activity (column 22, lines 23-33; column 
5, lines 59-67; column 6, lines 1-2; note that attempting to send a copy of the message 
100 times suggest that the penalty count dependent on previous undesirable sender's 
activity). 

Regarding claim 6: Donaldson et al teach the method of claim 5 wherein said 
time-dependent penalty count comprises a zero value subsequent to a pre-established 
retention period (column 17, lines 59-64; note that if the result is zero, then the remote 
host matches the particular node filter). 

Regarding claim 7: Donaldson et al teach the method of claim 5 wherein said 
time-dependent penalty count comprises a prior activity penalty count value reduced by 
a decay factor (column 21, lines 12-19; note that the filter scans the node name of the . 
remote host for certain sequences and adds or subtracts points). 

Regarding claim 8: Donaldson et al teach the method of claim 4 wherein said 
undesirable activity comprises a member of the group consisting of: sending a large 
number of e-mails (column 1, lines 14-20), sending e-mails of relatively large sizes 
(column 1, lines 17-19), using a relatively large amount of TCP connection time (column 
26, lines 1-11), and causing a TCP timeout (column 33, lines 20-23; Note the 
appearance of the interrupted TCP connection). 

Regarding claim 9: Donaldson et al teach the method of claim 1 wherein said 
system resource usage status is a function of a member of the group consisting of: the 
number of concurrent TCP connections being maintained (column 25, lines 59-64), the 
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number of e-mail files in an incoming message queue, and the amount of disk space 
being utilized for an incoming message queue (column 5, lines 52-58; Donaldson et al 
disclose a message store and its mail queue that keeps undelivered messaged for up to 
a week). 

Regarding claim 10: Donaldson et al teach the method of claim 1 wherein said 
step of processing the incoming e-mail comprises the step of assigning an operating 
state to the communication device, said operating state being a function of said system 
resource usage status (column 16, lines 15-19; Donaldson et al disclose a proxy which 
deallocates resources and resets internal state variables). 

Regarding claim 20: Donaldson et al teach a communication device for 
determining the disposition of incoming e-mail from a sender, said device comprising: 
a penalty count filter module (fig. 13, item 1401) having 

means for identifying the sender (column 6, lines 14-20; column 14, lines 63-67); 

means for assigning a penalty count to the sender, said penalty count being a 

function of undesirable activity associated with the sender (column 8, lines 

1-17); 

means for determining a resource usage value for said communication device in 

receiving e-mail (column 16, lines 12-19); 
means for specifying an operating state for said penalty count filter module, said 

operating state being a function of said resource usage value (column 16, 

lines 12-19); and 
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an accept/reject filter for disposing of the incoming e-mail on the basis of said 
sender penalty count and said operating state (column 3, lines 43-45). 

Regarding claim 21 : Donaldson et al teach the method of claim 20 wherein 
said means for identifying the sender includes means for obtaining at least one of a 
Domain Name Service verification {column 12, lines 45-49) and a peer IP address of the 
sender TCP connection {fig. 14, item 1404; fig. 13, item 1470). 

Regarding claim 22: Donaldson et al teach the method of claim 20 wherein 
said undesirable activity comprises a member of the group consisting of: 

sending a large number of e-mails {column 1, lines 14-20), sending e-mails of 
relatively large sizes {column 1, lines 17-19), using a relatively large amount of TCP 
connection time {column 26, lines 1-11), and causing a TCP timeout {column 33, lines 
20-23; Note the occurrence of the interrupted TCP connection). 

Regarding claim 23: Donaldson et al teach the method of claim 20 wherein 
said system resource usage status is a function of a member of the group consisting of: 
the number of concurrent TCP connections being maintained (column 25, lines 59-64), 
the number of e-mail files in an incoming message queue, and the amount of disk space 
being utilized for an incoming message queue {column 5, lines 52-58; Donaldson et al 
disclose a message store and its mail queue that keeps undelivered messaged for up to 
a week). 

Regarding claim 24: Donaldson et al teach a communication device for 
determining the disposition of incoming e-mail from a sender, said device comprising: 
a sender penalty count data structure for storing a current penalty count value 
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associated with the sender (column 23, lines 25-36; fig. 16, items 1500-1518; note that 
the data structure is represented by table 4 in column 23 and that matching count 
represents the penalty count); 

a system resource usage status file for storing a current usage status value for 
device e-mail processing resources (column 17, lines 27-48; note that the system 
resource becomes unavailable for email processing once the proxy determines that the 
remote network has been placed in a blacklisted database)] and 

an accept/reject filter for disposing of the incoming e-mail on the basis of said 
penalty count value (column 3, lines 43-45) and said usage status (column 17, table 1, 
hostname values). 

Regarding claim 25: Donaldson et al teach a method claim 24 wherein said 
sender penalty count data structure includes an entry comprising a member of the 
group consisting of: 

a sender identification value (column 22, lines 40-44), 

a cumulative penalty count value (column 22, lines 46-49), 

a cumulative e-mail count (column 32, lines 41-45; note that the number of 
recipient here represents the number of emails), 

a total e-mail size (column 32, lines 45-48), 

a total TCP connection time (column 26, lines 9-11), and 

a timestamp value (column 4, line 27). 
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Regarding claim 26: Donaldson et al teach a method suitable for use in a 
communication device for determining the disposition of incoming e-mail from a sender, 
said method comprising the steps of: 

identifying the e-mail sender by determining a sender IP address (column 6, lines 
14-24); 

obtaining a previous sender penalty count value calculated for said sender IP 
address (column 22, lines 40-49; note that the matching mechanism is used here as the 
penalty count and that the 32-bit address for the remote host is used to calculate the IP 
address of its 20 neighbors)] and 

accepting or rejecting the incoming e-mail based on said sender penalty count 
value (column 3, lines 43-45) and said usage status (column 17, table 1, hostname 
values). 

Regarding claim 27: Donaldson et al teach the method of claim 26 further 
comprising the steps of: 

maintaining a behavior trace table entry for the e-mail sender (column 21-22, 
table 3); and 

determining said previous sender penalty count from said behavior trace table 
(column 21-22, table 3, offset value). 

Regarding claim 28: Donaldson et al teach the method of claim 27 further 
comprising the step of updating sender behavior values in said trace table entry in 
response to receipt of a sender e-mail (column 17, lines 65-67; column 18, lines 1-7; 
fig. 14, item 1408; note that if the sender's IP address matches an entry in the blacklist 
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database, the proxy server issues an error reply to the remote host, closes the 
connection, logs the rejected connection, and exits without any email being transferred). 

Regarding claim 30: Donaldson et al teach the method of claim 28 wherein said 
step of updating sender behavior values comprises the steps of: 

reducing said behavior trace table value by a decay factor (column 21, lines 45- 
67; column 21, table 3; the offset value has a decay factor +f ); and 

adding a current behavior trace table value to said corresponding reduced 

behavior trace table value (column 21, lines 45-67; column 21, table 3). 

Regarding claim 32: Donaldson et al teach the method of claim 26 wherein said 
sender penalty count value is determined from undesirable sender activity occurring 
over a pre-established retention period (column 5, lines 52-58; note that the relay host 
will usually keep undelivered messages in its queue for up to a week). 

Regarding claim 33: Donaldson et al teach the method of claim 32 wherein said 
undesirable activity comprises a member of the group consisting of: 

sending a large number of e-mails (column 1, lines 14-20), sending e-mails of 
relatively large sizes (column 1, lines 17-19), using a relatively large amount of TCP 
connection time (column 26, lines 1-1 1 ), and causing a TCP timeout (column 5, line 52- 
54; column 33, lines 20-23; note the occurrence of the interrupted TCP connection). 

Regarding claim 34: Donaldson et al teach the method of claim 26 further 
comprising the step of updating said sender penalty count value (column 21, lines 12- 
15). 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 11-13 are rejected under 35 U.S.C. 102(e) as being unpatentable over 
Donaldson et al (U.S. 6,321,267 B1) in view of Munger et al (U.S. 6,502,135 B1). 

Regarding claim 11: Donaldson et al teach the method of claim 10 wherein 
said operating state is a member of the group consisting of: a normal operating state 
(column 16, lines 15-19), a selective-rejection operating state (column 14, lines 63-67, 
column 15, lines 1-2), but fail to disclose a random-rejection operating state. 

However, Munger et al (column 26, lines 14-24) teach a method that comprises 
a step with "random sync values that feed a random Number Generator and that are 
compared to the IP address to validate or reject the incoming packet ". 

It would have been obvious for an ordinary skill in the art at the time of the 
invention to use the random rejection of incoming packets of Munger et al and substitute 
the packets with incoming email messages of Donaldson et al to obtain to random 
rejection of undesirable email messages. 

Munger et al teach that it is old and well known in the communications art to get 
the advantage of using a random rejection to allow filtering of packets entering a 
network to enhance network security. An artisan in the networking art at the time of the 
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invention would have been motivated to include this mechanism to get the advantage in 
rejecting undesirable emails in an electronic network . 

Regarding claim 12: Donaldson et al and Munger et al teach all the limitations 
of claim 1 1 and Donaldson et al further disclose a method wherein, for said selective- 
rejection state, if said cumulative penalty count value has a zero value, said step of 
processing the incoming e-mail comprises the step of accepting the incoming e-mail 
{column 17, lines 58-64). 

Regarding claim 1 3: Donaldson et al teach all the limitations of claim 11, but 
fail to teach a method wherein, for said selective-rejection state, if said cumulative 
penalty count value has a nonzero value, said step of processing the incoming e-mail 
comprises the steps of: specifying a rejection factor; generating a random number; and 
randomly rejecting the incoming e-mail on the basis of said rejection factor and said 
random number. 

However, Munger et al {column 18, lines 52-56) teach a method that comprises 
a step with "a fast packet rejection mechanism that is a factor for rejecting invalid 
packets". Munger et al {column 24, lines 63-67) disclose a step "to generate a Random 
Number Sequence that yields a specific random number value, which in turn yields a 
specific IP address". 

It would have been obvious for an ordinary skill in the art at the time of the 
invention to combine the rejection factor and the random number value generated by 
Munger et al, and integrate them into Donaldson et al incoming email from the remote 
sender to randomly reject undesirable email messages. 
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Munger et al teach that it is old and well known in the communications art to get 
the advantage of using a rejection factor and a random number to randomly reject 
incoming e-mails to allow filtering of junk mails and as a result to enhance network 
security. An artisan in the networking art at the time of the invention would have been 
motivated to include this combination to get the advantage in rejecting undesirable 
emails in an electronic network . 

6. Claims 29 are rejected under 35 U.S.C. 102(e) as being unpatentable over 
Donaldson et al (U.S. 6,321,267 B1) in view of Barchi et al (U.S. 6,507,866 B1). 

Regarding claim 29: Donaldson et al teach all the limitations of claim 28 
wherein said sender behavior values include a member of the group consisting of: 
the number of e-mails (column 32, lines 41-47; note that the number of recipient here 
represents the number of emails), and total time of TCP connection time (column 14, 
lines 43-47), but fail to teach a method with a sender behavior values that includes the 
total size of e-mails. 

However, Barchi et al (column 9, lines 1-35) teach a step to define a sample 
email filtering system "to include all e-mail messages that are tracked by unexpired 
records within the list f where N is a predetermined integer 31 . 

It would have been obvious for an ordinary skill in the art at the time of the 
invention to add the total size of e-mails of Barchi et al to the number of e-mails and the 
total time of TCP connection time of Donaldson et al to complete the list of sender 
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behavior values and enhance the filtering of undesirable email messages in the 
system. 

Barchi et al teach that it is old and well known in the communications art to get 
the advantage of using a mechanism to find the total size of incoming mails in an 
electronic network to enhance security. An artisan in the networking art at the time of 
the invention would have been motivated to include this step to get the advantage in 
rejecting undesirable emails in an electronic network. 
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Conclusion 



7. Any inquiry concerning this communication or earlier communications from 
examiner should be directed to Jude Jean-Gilles whose telephone number is (703) 305- 
0269. The examiner can normally be reached on Monday-Thursday and every other 
Friday from 8:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley, can be reached on (703) 308-5221. The fax phone number for 
the organization where this application or proceeding is assigned is (703) 305-3719. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Jude Jean-Gilles 
Patent Examiner 
Art Unit 2143 



JJG 



September 29,2004 
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